Audit logging in Apache Superset
Using the Action Log and a custom event logger to record who viewed, queried and changed what, shipping events to a SIEM and keeping the built-in log view working.

Day-two work on a running Superset: audit and event logs, metrics, usage analysis, report troubleshooting, user administration, backups and image scanning.
Using the Action Log and a custom event logger to record who viewed, queried and changed what, shipping events to a SIEM and keeping the built-in log view working.
Exporting Superset and Gunicorn metrics through StatsD into Prometheus or another backend, the endpoints and events worth alerting on and dashboards for the web and worker tiers.
Answering who uses which dashboards from the metadata logs table: monthly active users, unused dashboards, heavy queries and building an admin dashboard in Superset itself.
Fixing reports that do not arrive: Celery beat and workers, Playwright and Chromium in the image, executor users, dry-run mode, SMTP and Slack scopes, timeouts and large dashboard screenshots.
Provisioning and deprovisioning users and roles through the Superset REST API: syncing from HR or IdP systems, the FAB security API flag, auditing changes and pairing it with SSO.
Protecting dashboards, users and connections: database backups, matching SECRET_KEY for encrypted fields, export bundles as a second layer and testing restores.
Triaging high and critical findings in Superset images: OS and Python dependency CVEs versus Superset issues, rebuilding on patched bases, lean images and documenting accepted risk.
What Superset reports through Scarf by default, how to opt out with SCARF_ANALYTICS, and why regulated and air-gapped deployments usually disable it.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.